8 ms·

There's so much ambiguity in this, though. Can't the complying Australian employee simply nudge his/her coworker and say "hey, patch this later" and then it's j

There's so much ambiguity in this, though. Can't the complying Australian employee simply nudge his/her coworker and say "hey, patch this later" and then it's just a game of back and forth with the Australian government not having their way in the end?

cma 8y ago
Australia could offer a reward to employees that ratted out employees that did that. Then other countries with have to outlaw accepting the reward.
jacques_chester 8y ago
I wouldn't advise this. Defying or subverting a lawful order can itself be a crime and you can bet the Crown Prosecutor and the Judge have seen far more attempts than you have.
- Mirioron 8y ago
  Can you imagine what would happen if there was a public case where a person got 5 years for letting the world know that the Australian government tried to force them to backdoor software? You don't really even need proof, because if he's sent to prison then his claim is true. Right now the risk from Australia is theoretical. After that there could actually be bans from other governments about using software made in Australia.
  - jacques_chester 8y ago
    I imagine the person would go to prison for up to 5 years and the government would chest-thump about Being Tough On Baddies. If anything they would like it to happen. If being exposed as a stupid law was enough to scare off the major parties, it wouldn't have been made law in the first place.
mastazi 8y ago
There are many scenarios where the Australian Government ends up not having it their way. For example a very likely scenario is: your commit which contains a backdoor goes to code review and then someone asks you "what is this". In theory you would say that you are not allowed to explain for legal reasons. Yet that commit is not going to be deployed. (edited for clarity)
Macross8299 8y ago
I mean, you're pretty much advocating for the rough equivalent of a warrant canary, which have already been explicitly outlawed in Australia. [0] [0]: https://boingboing.net/2015/03/26/australia-outlaws-warrant-cana.html https://boingboing.net/2015/03/26/australia-outlaws-warrant-...
- cyphar 8y ago
  Please note that the legislation you are referencing is completely unrelated to the Assistance and Access Act. It's talking about journalistic warrants (warrants on journalists not by journalists) which are their own shitstorm, but a very different topic. The Assistance and Access Act does have the same "existence or nonexistence" wording as the law you referred to, so you're not wrong that a warrant canary for a notice under the new legislation would be a criminal offense. But there is no blanket law against warrant canaries per se, it's done explicitly in each new law about secret warrants.
SimplePeople 8y ago
I imagine that the government would begin at the executive level and ask "who else needs to know" and then work down the list to compel individuals or teams as required. Similar processes already exist for other legal/police requests. If this legislation is used, companies like Telstra will have dedicated teams to comply with requests. If your new Australian Citizen hire can build back doors into your software you've got bigger issues than hiring. Though I could see real risk associated with an Australian-based team for a global company or an Australian-based supplier.
BLKNSLVR 8y ago
The Australian Government does not like whistleblowers: https://www.abc.net.au/news/2018-06-28/witness-k-and-bernard-collaery-charged-intelligence-act-breach/9919268 https://www.abc.net.au/news/2018-06-28/witness-k-and-bernard... I can't stress enough the potential for harm in any attempt to bypass various laws. The Australian Government even refused to allow independent Medical Doctors into their off-shore immigration detention centres for fear of the detention conditions being made public. Australia did nothing to even consider trying to maybe help Julian Assange, an Australian citizen seeking protection from nation-backed harassment, way back when, and two Australian citizens were murdered by the Indonesian Government for drug trafficking (Australia negotiated prior to the event, but no negative action was taken afterwards). These are admittedly both divisive examples - with the intention to point out that it depends on the direction of political winds as to how the Australian Government will react. Australia is a good place to live and the anecdotes above are specifically chosen as the far end of the bad scale, but if you choose a fight with any of the few specific issues the Government is paranoid about or sensitive to, you may face significant resources aimed at your incarceration. Just make sure your ass is thrice covered if you're going to go up against it...
- marcus_holmes 8y ago
  Australia's public image of being a "larrikin" place - all beer on the beach and shrimp on the barbie, is at odds with its incredibly authoritarian attitudes. I'm always amazed at Aussie enthusiasm for the "smack of firm government" and their hatred of anyone breaking the rules.
  - int_19h 8y ago
    It's really strange that of all the former British settler colonies, the one that's the most republican in attitude is also the one that's most enthusiastic about maintaining the surveillance/police state parity with UK. Canada and NZ are doing much better.
  - BLKNSLVR 8y ago
    The beaches and sunshine mean that there are better things to do than worry about f*cking politics. Australian frogs are coming to the boil.
marcus_holmes 8y ago
I've had long discussions with techie friends about this, and none of us can see a way that the government could actually force a dev to do anything in a way that doesn't immediately tip off the rest of the team. I mean, your code is stored in a shared repo, right? So pushing a commit with the government-mandated changes to the shared repo is "informing others". But not pushing it means it'll never get to Prod. Most places review code commits routinely, so how is a dev supposed to get their government-mandated changes into Prod without anyone seeing them? If your Australian co-worker stops pushing their commits to the repo and starts trying to make changes to Prod without going through review, it's also a strong signal that something might be going on here... In fact, if this legislation posed any kind of threat to your business, then your software development processes are broken and you're vulnerable to a ton of other, more likely, threats. The legislation was written by a shower of technically-incompetent career politicians, with absolutely zero understanding of (or interest in) how software development works. This is the same mob of idiots of pronounced "the laws of mathematics are all very well, but we're in Australia so we obey Australian laws" when discussing their plans to break cryptography. It's unenforceable, ridiculous, and will get changed before it ever gets used. But as a startup tech co-founder dealing with encrypted documents, and an Australian citizen, I'm not planning to launch in Australia until it's fixed, and leaving Australia until it's fixed.
- fgnjksadklafs 8y ago
  Really? It took me about 10 seconds to come up with this: "Hey tech dude, we need a version of iOS that unlocks the encryption on this device. Be a good boy and send us an IPSW that we can install on this nasty person's phone will you?" You don't need to release it to the public. Build it on your local device and hand it to them. Nobody needs to know.
  - lozenge 8y ago
    The number of people with access to the private keys that sign iOS updates must be very limited - I wouldn't be surprised if you needed at least two people actively involved in signing every update. On top of that, Apple is heavily siloed, and somebody working on the Calendar app won't have information on the operation of Secure Enclave, the chip that deals with authenticating fingerprints, passcodes, Apple Pay etc. So it would be more like "Hey tech dude, can you sneak a change to the compiler your company uses to build iOS, to have it compile a backdoor into iOS, then surreptitiously login to the relevant machines and place your new compiler?"
cyphar 8y ago
Unauthorised disclosure of information about a notice (or gained from a notice) is punishable with 5 years imprisonment -- which means that if you're suspected of being a whistleblower they can use this new legislation against you too (anything punishable with over 3 years imprisonment can be investigated in this fashion). I wouldn't risk it. There are ways to legally provide aggregated information about the number of notices received in a 6-month period. Also, talk to your representative and explain your concerns and push for it to be scrapped (though when I talked to the Labor senators' staffers they brushed me off and said that I wasn't interested in being informed when I disagreed with their party line). Federal elections are coming up, they're more likely to at least pretend to listen to you.

cma 8y ago

Australia could offer a reward to employees that ratted out employees that did that. Then other countries with have to outlaw accepting the reward.

jacques_chester 8y ago

I wouldn't advise this. Defying or subverting a lawful order can itself be a crime and you can bet the Crown Prosecutor and the Judge have seen far more attempts than you have.

Mirioron 8y ago
Can you imagine what would happen if there was a public case where a person got 5 years for letting the world know that the Australian government tried to force them to backdoor software? You don't really even need proof, because if he's sent to prison then his claim is true. Right now the risk from Australia is theoretical. After that there could actually be bans from other governments about using software made in Australia.
- jacques_chester 8y ago
  I imagine the person would go to prison for up to 5 years and the government would chest-thump about Being Tough On Baddies. If anything they would like it to happen. If being exposed as a stupid law was enough to scare off the major parties, it wouldn't have been made law in the first place.

mastazi 8y ago

There are many scenarios where the Australian Government ends up not having it their way. For example a very likely scenario is: your commit which contains a backdoor goes to code review and then someone asks you "what is this". In theory you would say that you are not allowed to explain for legal reasons. Yet that commit is not going to be deployed. (edited for clarity)

Macross8299 8y ago

I mean, you're pretty much advocating for the rough equivalent of a warrant canary, which have already been explicitly outlawed in Australia. [0] [0]: https://boingboing.net/2015/03/26/australia-outlaws-warrant-cana.html https://boingboing.net/2015/03/26/australia-outlaws-warrant-...

cyphar 8y ago
Please note that the legislation you are referencing is completely unrelated to the Assistance and Access Act. It's talking about journalistic warrants (warrants on journalists not by journalists) which are their own shitstorm, but a very different topic. The Assistance and Access Act does have the same "existence or nonexistence" wording as the law you referred to, so you're not wrong that a warrant canary for a notice under the new legislation would be a criminal offense. But there is no blanket law against warrant canaries per se, it's done explicitly in each new law about secret warrants.

SimplePeople 8y ago

I imagine that the government would begin at the executive level and ask "who else needs to know" and then work down the list to compel individuals or teams as required. Similar processes already exist for other legal/police requests. If this legislation is used, companies like Telstra will have dedicated teams to comply with requests. If your new Australian Citizen hire can build back doors into your software you've got bigger issues than hiring. Though I could see real risk associated with an Australian-based team for a global company or an Australian-based supplier.

BLKNSLVR 8y ago

The Australian Government does not like whistleblowers: https://www.abc.net.au/news/2018-06-28/witness-k-and-bernard-collaery-charged-intelligence-act-breach/9919268 https://www.abc.net.au/news/2018-06-28/witness-k-and-bernard... I can't stress enough the potential for harm in any attempt to bypass various laws. The Australian Government even refused to allow independent Medical Doctors into their off-shore immigration detention centres for fear of the detention conditions being made public. Australia did nothing to even consider trying to maybe help Julian Assange, an Australian citizen seeking protection from nation-backed harassment, way back when, and two Australian citizens were murdered by the Indonesian Government for drug trafficking (Australia negotiated prior to the event, but no negative action was taken afterwards). These are admittedly both divisive examples - with the intention to point out that it depends on the direction of political winds as to how the Australian Government will react. Australia is a good place to live and the anecdotes above are specifically chosen as the far end of the bad scale, but if you choose a fight with any of the few specific issues the Government is paranoid about or sensitive to, you may face significant resources aimed at your incarceration. Just make sure your ass is thrice covered if you're going to go up against it...

marcus_holmes 8y ago
Australia's public image of being a "larrikin" place - all beer on the beach and shrimp on the barbie, is at odds with its incredibly authoritarian attitudes. I'm always amazed at Aussie enthusiasm for the "smack of firm government" and their hatred of anyone breaking the rules.
- int_19h 8y ago
  It's really strange that of all the former British settler colonies, the one that's the most republican in attitude is also the one that's most enthusiastic about maintaining the surveillance/police state parity with UK. Canada and NZ are doing much better.
- BLKNSLVR 8y ago
  The beaches and sunshine mean that there are better things to do than worry about f*cking politics. Australian frogs are coming to the boil.

marcus_holmes 8y ago

I've had long discussions with techie friends about this, and none of us can see a way that the government could actually force a dev to do anything in a way that doesn't immediately tip off the rest of the team. I mean, your code is stored in a shared repo, right? So pushing a commit with the government-mandated changes to the shared repo is "informing others". But not pushing it means it'll never get to Prod. Most places review code commits routinely, so how is a dev supposed to get their government-mandated changes into Prod without anyone seeing them? If your Australian co-worker stops pushing their commits to the repo and starts trying to make changes to Prod without going through review, it's also a strong signal that something might be going on here... In fact, if this legislation posed any kind of threat to your business, then your software development processes are broken and you're vulnerable to a ton of other, more likely, threats. The legislation was written by a shower of technically-incompetent career politicians, with absolutely zero understanding of (or interest in) how software development works. This is the same mob of idiots of pronounced "the laws of mathematics are all very well, but we're in Australia so we obey Australian laws" when discussing their plans to break cryptography. It's unenforceable, ridiculous, and will get changed before it ever gets used. But as a startup tech co-founder dealing with encrypted documents, and an Australian citizen, I'm not planning to launch in Australia until it's fixed, and leaving Australia until it's fixed.

fgnjksadklafs 8y ago
Really? It took me about 10 seconds to come up with this: "Hey tech dude, we need a version of iOS that unlocks the encryption on this device. Be a good boy and send us an IPSW that we can install on this nasty person's phone will you?" You don't need to release it to the public. Build it on your local device and hand it to them. Nobody needs to know.
- lozenge 8y ago
  The number of people with access to the private keys that sign iOS updates must be very limited - I wouldn't be surprised if you needed at least two people actively involved in signing every update. On top of that, Apple is heavily siloed, and somebody working on the Calendar app won't have information on the operation of Secure Enclave, the chip that deals with authenticating fingerprints, passcodes, Apple Pay etc. So it would be more like "Hey tech dude, can you sneak a change to the compiler your company uses to build iOS, to have it compile a backdoor into iOS, then surreptitiously login to the relevant machines and place your new compiler?"

cyphar 8y ago

Unauthorised disclosure of information about a notice (or gained from a notice) is punishable with 5 years imprisonment -- which means that if you're suspected of being a whistleblower they can use this new legislation against you too (anything punishable with over 3 years imprisonment can be investigated in this fashion). I wouldn't risk it. There are ways to legally provide aggregated information about the number of notices received in a 6-month period. Also, talk to your representative and explain your concerns and push for it to be scrapped (though when I talked to the Labor senators' staffers they brushed me off and said that I wasn't interested in being informed when I disagreed with their party line). Federal elections are coming up, they're more likely to at least pretend to listen to you.